FreeScout Help Desk Vulnerability Exposes Hidden Conversation Drafts

The National Vulnerability Database (NVD) has detailed CVE-2026-41190, a high-severity vulnerability (CVSS 7.1) affecting FreeScout, a popular self-hosted help desk solution. Prior to version 1.8.215, FreeScout’s APP_SHOW_ONLY_ASSIGNED_CONVERSATIONS setting, intended to restrict user access to conversations, had a critical bypass. While direct UI access was correctly blocked for unauthorized users, the save_draft AJAX endpoint did not enforce these same restrictions.

This flaw allowed a low-privileged authenticated user to directly POST to the save_draft path and create drafts within conversations they were not authorized to view. Although these drafts remained hidden from the unauthorized user’s UI, they were successfully created within the restricted conversation. This constitutes a significant information integrity and confidentiality risk, as sensitive internal communications could be silently infiltrated or manipulated.

Defenders leveraging FreeScout must prioritize patching to version 1.8.215 immediately. This vulnerability, categorized as CWE-863 (Improper Authorization), highlights a common pitfall in access control implementations: inconsistent enforcement across different application layers and API endpoints. Always assume that UI restrictions can be bypassed by direct API calls if not robustly secured at the backend.